568 matches found
CVE-2023-51730: Improper Neutralization of Input During Web Page Generation
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the DDNS Password parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web...
CVE-2024-23059
TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function...
CVE-2023-49691
A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.0, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.0, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.0, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.0, SCALANCE...
Command injection
A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.0, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.0, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.0, SCALANCE M812-1 ADSL-Router Annex A 6GK5812-1AA00-2AA2 All versions V8.0,...
CVE-2023-49691
CVE-2023-49691 is an OS command injection vulnerability found in Siemens SCALANCE/ RUGGEDCOM devices via the DDNS handling. The root cause is improper neutralization of special elements used in an OS command, enabling a local attacker with administrative privileges to run commands at system level...
CVE-2023-49691
A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.0, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.0, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.0, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.0, SCALANCE...
CVE-2023-49691: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.0, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.0, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.0, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.0, SCALANCE...
PT-2023-7781 · Siemens · Scalance M826-2 Shdsl-Router +11
Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.0 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.0 SCALANCE M804PB versions prior to V8.0 SCALANCE M812-1 ADSL-Router versions prior to V8.0 SCALANCE M816-1 ADSL-Router versions prior to V8.0...
NETIS SYSTEMS N3 Command Injection Vulnerability
NETIS SYSTEMS N3 is a router from NETIS SYSTEMS. A security vulnerability exists in the NETIS SYSTEMS N3 Mv2-V1.0.1.865 version, which stems from a command injection vulnerability that includes the ddnsDomainName parameter via dynamic DNS settings...
Denial of service
A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...
SoftEther VPN DCRegister DDNS_RPC_MAX_RECV_SIZE denial of service vulnerability
Talos Vulnerability Report TALOS-2023-1736 SoftEther VPN DCRegister DDNSRPCMAXRECVSIZE denial of service vulnerability October 12, 2023 CVE Number CVE-2023-22325 SUMMARY A denial of service vulnerability exists in the DCRegister DDNSRPCMAXRECVSIZE functionality of SoftEther VPN 4.41-9782-beta,...
VulnCheck KEV: CVE-2022-27002
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddnsname, ddnspwd, hddns、ddnshost parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
SystemK NVR 504/508/516 Command Injection
Exploit Title: SystemK NVR 504/508/516 Command Injection Exploit Author: Keniver Wang Publish Date: 19/06/2023 Date of found: 20/01/2021 Vendor: SystemK Vendor Homepage: https://nvr.bz/ Version: NVR 504/508/516 2.3.5SK.30084998 Greets: Weber Tsai CHT Security Description A Command Injection...
D-Link Multiple DIR Devices RCE Vulnerability (Feb 2022)
Multiple D-Link DIR devices are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Flaws over DHCP and DNS keys encryption scheme
...
Tenda AC23 Out-of-Bounds Write Vulnerability
Tenda AC23 is a home dual-band wireless router launched by Tenda, focusing on large home coverage and high-speed transmission, supporting 802.11acWave2 technology, dual-band concurrent rate up to 2033Mbps. Tenda AC23 suffers from an out-of-bounds write vulnerability, which originates from the...
Tenda AC23 缓冲区错误漏洞
Tenda AC23 is a home dual-band wireless router launched by Tenda, focusing on large home coverage and high-speed transmission, supporting 802.11acWave2 technology, dual-band concurrent rate up to 2033Mbps. Tenda AC23 suffers from an out-of-bounds write vulnerability, which originates from the...
PT-2023-7624 · Tenda · Tenda Ac23
Name of the Vulnerable Software and Affected Versions: Tenda AC23 version 16.03.07.45 Description: The issue is related to a stack-based buffer overflow in the formSetSysToolDDNS/formGetSysToolDDNS function of the /bin/httpd file. This can be exploited by a remote attacker to cause a denial of...
(Pwn2Own) Western Digital MyCloud PR4100 DDNS Response Processing Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DDNS responses. The issue results from the lack...
